Determining abnormal conditions of host state from log files through Markov modeling
AssigneeAmazon Technologies, Inc.
InventorsCarl Bellingan, Atle Jorgensen
Life of this patent
Estimating the term…
Abstract
Embodiments are disclosed for determining whether a computing node is in a normal or an abnormal condition based on its characteristics relative to those of other computing nodes. In embodiments, log files for the computing node are used to develop a state model of the computing node, and where the state model differs between two similar computing nodes, an abnormality is identified. In other embodiments, characteristics about computing nodes (e.g., CPU resources used) are used to cluster those computing nodes, and those computing nodes that lie outside of a cluster are identified as abnormal.
Claims18
A system for determining whether a first computing node is in an abnormal condition, comprising:
- a plurality of computing nodes comprising the first computing node;
- at least one memory bearing instructions that, upon execution, cause the system at least to:
- receive information about at least a subset of the plurality of computing nodes that is stored in at least one log file, the information identifying a first action and a second action of the subset of the plurality of computing nodes, and an order in which the first and second actions occur;
- determine a first state for a state model based on the first action identified in the at least one log file;
- determine a second state for the state model based on the second action identified in the at least one log file;
- determine a transition from the first state to the second state in the state model based on the order in which the first and second actions occur in the at least one log file;
- determine a second state model for a second computing node of the plurality of computing nodes based on information about the second computing node that is stored in a second log file;
- determine that the second state model and the state model differ by at least a predetermined amount;
- and
- determine that the second computing node is in an abnormal condition in response to determining that the second state model and the state model differ by at least the predetermined amount.
A computer-implemented method for determining whether a computing service is in an abnormal condition, comprising:
- logging information relating to operations of a computing service in a database;
- in response to sending a request to the database, receiving an identification of a first action and an identification of a second action of the computing service from the database, and an identification of an order in which the first and second actions occur from the database;
- determining a first state for a state model based on the first action;
- adding a determined second state for the state model based on the second action;
- computing a transition from the first state to the second state in the state model based on the order in which the first and second actions occur;
- determining a second state model for the computing service based on an identification of additional actions of the computing service or based on another computing service;
- determining that the second state model and the state model differ by at least a predetermined amount;
- and
- wherein determining that the computing service or the another computing service is in the abnormal condition is in response to determining that the second state model and the state model differ by at least the predetermined amount.
A non-transitory computer-readable medium, bearing computer-readable instructions that, when executed on a computing service, cause the at least one computing service to perform operations comprising:
- receiving an identification of first action and an identification of a second action of the computing service, and an identification of an order in which the first and second actions occur;
- determining a first state for a state model based on the first action;
- determining a second state for the state model based on the second action;
- and
- determining a transition from the first state to the second state in the state model based on the order in which the first and second actions occur;
- determining a second state model for the computing service based on an identification of additional actions of the computing service or based on another computing service;
- determining that the second state model and the state model differ by at least a predetermined amount;
- and
- determining that the computing service or the another computing service is in an abnormal condition in response to determining that the second state model and the state model differ by at least the predetermined amount.
Dependencies are inferred from the claim text.